Security Compliance Program Manager

We are currently looking to hire a Security Compliance Program Manager for LaBella's Operations Department. This position is located at our Rochester, NY office.

The primary responsibilities of this position are the program management, administration, and maintenance of LaBella’s ISO 27001 and Information Security System (ISMS) program. 

Specific Duties/Responsibilities include but are not necessarily limited to the following:

•  Management of LaBella’s ISMS committee including scheduling, providing agendas, and keeping minutes of meetings, ensuring membership is maintained as current and relevant.

• Management of LaBella’s ISO 27001 and Information Security Management System (ISMS) program, in cooperation with the Security Operations Manager, including but not limited to:

• Security policy, process, and procedure development and maintenance, in cooperation with Security, IT, and other department and division leadership.

• ISO 27001 document control, including versioning, management reviews and approvals, communication to employees, and updating/maintaining ISO 27001 document management sites including internal and external facing document control web-based sites.

• Developing and maintaining risk assessment and risk acceptance workflow, risk treatment/mitigation plans, and updating LaBella’s risk register in coordination with relevant department and division leaders and executive management on required intervals.

• Development of communication and coordination with executive, department, and division management, regional and office managers, internal and external communication managers, relevant third parties (clients, vendors, etc.), and LaBella data owners.

• Coordinate ISO audits with internal and external resources and develop, track, and communicate corrective action plans

• Collect and maintain ISO 27001/ ISMS evidence and control documentation, managing the GRC (Governance, Risk Management, and Compliance) platform

• Establish and maintain an ISMS control ownership model, including assignment of control owners, control performers, approvers, review frequency, evidence requirements, and escalation paths for overdue or deficient controls.

• Coordinate ISMS objectives, metrics, key performance indicators, and key risk indicators, and prepare recurring reporting for the ISMS committee, executive leadership, Security, IT, Operations, and other relevant stakeholders.

• Maintain an ISMS compliance calendar covering internal audits, external audits, management reviews, policy reviews, risk assessments, access reviews, supplier reviews, evidence collection deadlines, training requirements, and certification milestones.